feat(metrics): opt-in Prometheus /metrics endpoint + textfile collector #150
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: E2E (BPF LSM) | |
| on: | |
| pull_request: | |
| paths: | |
| - 'src/**' | |
| - 'bpf/**' | |
| - 'scripts/**' | |
| - 'tests/**' | |
| - 'CMakeLists.txt' | |
| - '.github/workflows/e2e.yml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'src/**' | |
| - 'bpf/**' | |
| - 'scripts/**' | |
| - 'tests/**' | |
| - 'CMakeLists.txt' | |
| - '.github/workflows/e2e.yml' | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 3 * * 0" | |
| permissions: | |
| contents: read | |
| jobs: | |
| e2e: | |
| if: github.event_name != 'pull_request' || vars.AEGIS_ENABLE_SELF_HOSTED_PR_GATES == 'true' | |
| runs-on: [self-hosted, bpf-lsm] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install dependencies (if apt-get is available) | |
| run: | | |
| if command -v apt-get >/dev/null 2>&1; then | |
| export DEBIAN_FRONTEND=noninteractive | |
| pkgs="clang llvm libbpf-dev libsystemd-dev pkg-config cmake ninja-build python3-jsonschema libelf-dev zlib1g-dev git libgtest-dev fsverity e2fsprogs" | |
| for attempt in 1 2 3; do | |
| if sudo apt-get -o DPkg::Lock::Timeout=120 update && \ | |
| sudo apt-get -o DPkg::Lock::Timeout=120 install -y $pkgs; then | |
| break | |
| fi | |
| echo "apt-get attempt ${attempt} failed; retrying in 10s..." | |
| sleep 10 | |
| done | |
| if ! pkg-config --exists libbpf || ! pkg-config --atleast-version=1.1.0 libbpf; then | |
| rm -rf /tmp/libbpf | |
| git clone --depth 1 --branch v1.4.0 https://github.com/libbpf/libbpf.git /tmp/libbpf | |
| make -C /tmp/libbpf/src | |
| sudo make -C /tmp/libbpf/src install | |
| echo "/usr/local/lib" | sudo tee /etc/ld.so.conf.d/libbpf.conf | |
| if [ -d /usr/local/lib64 ]; then | |
| echo "/usr/local/lib64" | sudo tee /etc/ld.so.conf.d/libbpf64.conf | |
| fi | |
| if [ -d /usr/lib64 ]; then | |
| echo "/usr/lib64" | sudo tee /etc/ld.so.conf.d/lib64.conf | |
| fi | |
| for dir in /usr/local/lib /usr/local/lib64; do | |
| if ls "$dir"/libbpf.so.* >/dev/null 2>&1; then | |
| sudo ln -sf "$(ls "$dir"/libbpf.so.* | head -n1)" "$dir/libbpf.so.1" | |
| fi | |
| done | |
| sudo ldconfig | |
| echo "PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig:${PKG_CONFIG_PATH}" >> "$GITHUB_ENV" | |
| echo "LD_LIBRARY_PATH=/usr/lib64:/usr/local/lib:/usr/local/lib64:${LD_LIBRARY_PATH}" >> "$GITHUB_ENV" | |
| fi | |
| if ! command -v bpftool >/dev/null 2>&1; then | |
| sudo apt-get -o DPkg::Lock::Timeout=120 install -y linux-tools-common || true | |
| sudo apt-get -o DPkg::Lock::Timeout=120 install -y "linux-tools-$(uname -r)" || \ | |
| sudo apt-get -o DPkg::Lock::Timeout=120 install -y linux-tools-gcp || \ | |
| sudo apt-get -o DPkg::Lock::Timeout=120 install -y linux-tools-generic || true | |
| fi | |
| if ! command -v bpftool >/dev/null 2>&1; then | |
| echo "bpftool is required but was not installed" >&2 | |
| exit 1 | |
| fi | |
| fi | |
| - name: Verify environment | |
| run: scripts/verify_env.sh --strict | |
| - name: Require BPF LSM | |
| run: grep -qw bpf /sys/kernel/security/lsm | |
| - name: Configure | |
| run: | | |
| rm -rf build | |
| cmake -S . -B build -G Ninja \ | |
| -DCMAKE_BUILD_TYPE=Release \ | |
| -DBUILD_TESTING=ON \ | |
| -DSKIP_BPF_BUILD=OFF | |
| - name: Build | |
| run: cmake --build build | |
| - name: Unit tests | |
| run: ctest --test-dir build --output-on-failure --timeout 120 | |
| - name: Health check | |
| run: sudo ./build/aegisbpf health | |
| - name: Pinned map mismatch recovery | |
| run: | | |
| # Ensure layout mismatch is detected and the recovery path works. | |
| sudo bpftool map update pinned /sys/fs/bpf/aegisbpf/agent_meta \ | |
| key hex 00 00 00 00 \ | |
| value hex 02 00 00 00 | |
| set +e | |
| out="$(sudo ./build/aegisbpf health 2>&1)" | |
| rc="$?" | |
| set -e | |
| echo "$out" | |
| if [[ "$rc" -eq 0 ]]; then | |
| echo "expected health to fail due to pinned map layout mismatch" >&2 | |
| exit 1 | |
| fi | |
| echo "$out" | grep -qi "Pinned maps layout version mismatch" | |
| sudo ./build/aegisbpf block clear | |
| sudo ./build/aegisbpf network deny clear | |
| sudo ./build/aegisbpf health | |
| - name: Reset pinned policy state | |
| run: | | |
| sudo ./build/aegisbpf block clear | |
| sudo ./build/aegisbpf network deny clear | |
| - name: Enforce smoke test | |
| run: sudo env ENFORCE_SIGNAL=none scripts/smoke_enforce.sh | |
| - name: VERIFIED_EXEC (fs-verity) enforcement | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo BIN=./build/aegisbpf scripts/e2e_verified_exec_fsverity.sh 2>&1 | tee artifacts/e2e/verified_exec_fsverity.log | |
| - name: Audit fallback smoke test | |
| run: sudo scripts/smoke_audit_fallback.sh | |
| - name: E2E bypass tests | |
| run: sudo ./build/aegisbpf_bypass_test | |
| - name: Filesystem enforcement matrix | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo scripts/e2e_fs_matrix.sh 2>&1 | tee artifacts/e2e/fs_matrix.log | |
| - name: Namespace enforcement matrix | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo scripts/e2e_namespace_matrix.sh 2>&1 | tee artifacts/e2e/namespace_matrix.log | |
| - name: Edge-case enforcement matrix | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo BIN=./build/aegisbpf \ | |
| SUMMARY_OUT=artifacts/e2e/matrix_summary.json \ | |
| scripts/e2e_file_enforcement_matrix.sh | |
| python3 scripts/validate_e2e_matrix_summary.py \ | |
| artifacts/e2e/matrix_summary.json \ | |
| --min-total-checks 100 \ | |
| --max-failed-checks 0 | |
| - name: Short soak reliability | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo AEGIS_BIN=./build/aegisbpf \ | |
| DURATION_SECONDS=180 \ | |
| MAX_RINGBUF_DROPS=100 \ | |
| MAX_RSS_GROWTH_KB=65536 \ | |
| OUT_JSON=artifacts/e2e/soak_summary.json \ | |
| scripts/soak_reliability.sh | |
| - name: Enforcement claims proofs | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo BIN=./build/aegisbpf \ | |
| scripts/e2e_enforcement_proofs.sh 2>&1 | tee artifacts/e2e/enforcement_proofs.log | |
| - name: Chaos ringbuf overflow | |
| run: | | |
| mkdir -p artifacts/e2e | |
| sudo AEGIS_BIN=./build/aegisbpf \ | |
| RINGBUF_BYTES=1024 \ | |
| EVENT_SAMPLE_RATE=1 \ | |
| WORKERS=32 \ | |
| DURATION_SECONDS=30 \ | |
| TARGET_DROPS=1 \ | |
| OUT_JSON=artifacts/e2e/chaos_ringbuf.json \ | |
| scripts/chaos_ringbuf_overflow.sh | |
| - name: Capture E2E environment | |
| if: always() | |
| run: | | |
| mkdir -p artifacts/e2e | |
| uname -a > artifacts/e2e/kernel.txt | |
| cat /etc/os-release > artifacts/e2e/os-release.txt || true | |
| lscpu > artifacts/e2e/cpu.txt || true | |
| - name: Upload E2E evidence | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: e2e-evidence | |
| path: artifacts/e2e/ | |
| if-no-files-found: warn |